Reposted from CISA/DHS

We would like to invite you to the Commercial Facilities Sector's Quarterly Threat & Initiatives Briefing on Tuesday, December 10th, 2024, from 2:00 PM – 3:00 PM EST. This virtual briefing will focus on Seasonal Security Threats Facing Commercial Facilities Post-Election and During the Holiday Period. While this session is primarily for stakeholders within the Commercial Facilities Sector, all partners and interested parties are welcome to attend.

Please click the link below to register: https://events.gcc.teams.microsoft.com/event/d3e46091-06d4-4958-8f0b-0adbf0d0793a@69c613d2-b051-4234-8ed1-fd530b70d5d3

Agenda:

• 2:00 PM - 2:05 PM: Opening Remarks
  Michael Stewart, Commercial Facilities Sector
  Nick Williams, Region 3 Sector Outreach Coordinator
• 2:05 PM - 2:25 PM: “Physical and Cyber Threat Overview”
  Luis Rovira, DHS Office of Intelligence & Analysis
• 2:25 PM - 2:45 PM: “Protective Security Advisor Options for Consideration”
  Bob Winters, Protective Security Advisor – Pittsburgh
• 2:45 PM - 3:00 PM: Question and Answer Session 
• The meeting will be conducted virtually and is unclassified, so please feel free to share this invite with others who may benefit.

See Original Post

 

Reposted from CISA/DHS

The Cybersecurity and Infrastructure Security Agency (CISA) published Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a U.S. Critical Infrastructure Sector Organization. This advisory provides network defenders and software manufacturers with recommendations for improving their cybersecurity posture based on lessons learned and key findings from an assessment.  Key findings of ineffective cybersecurity practices in this advisory include:  

• Perimeter network was not adequately firewalled from its internal network.  
• Over reliance on host-based tools and lack of network layer protections, such as well-configured web proxies or intrusion prevention systems (IPS)
• Insufficient legacy host monitoring that lacks a local end-point detection and response solution.  
• Insecure configurations on multiple systems including default server, hosts with unconstrained delegation enabled unnecessarily, and account configuration.   
• No review of security alerts by network defenders.   
• Inadequate identity management; and  
• Use of known insecure and outdated software.   

Lessons learned from this assessment include:  

• Assess and ensure sufficient technical controls to prevent and detect malicious activity.  
• Require continuous training, support, and resources to implement secure software configurations and detect malicious activity; and  
• Effective organizational leadership will not minimize the business risk of known attack vectors or deprioritize the treatment of a vulnerability their own cybersecurity team identifies.  

CISA encourages all organizations to review this advisory and apply the recommended mitigations which will help ensure security processes and procedures are up to date and effective.  

CISA also urges software manufacturers to embrace Secure by Design principles and implement the recommended actions and mitigations to improve security outcomes of their customers from real-world threats. The findings in this advisory illustrate the outsized burden and costs of compensating for insecure software and hardware borne by critical infrastructure owners and operators. 

See Original Post 

Reposted from CISA/DHS

To celebrate National Critical Infrastructure Security and Resilience Month, the Office of the Director of National Intelligence NCSC and CISA, as the National Coordinator for Critical Infrastructure Security and Resilience, released NEW guidance to assist critical infrastructure owners and operators to detect and mitigate efforts by foreign intelligence entities to disrupt U.S. critical infrastructure. We are excited to share this guidance with you! As a nation, we are seeing continued cyber and physical threats to critical infrastructure Americans rely on every day. U.S. adversaries and their foreign intelligence entities understand the importance of the critical infrastructure sectors and how degrading them could hinder our national response to events. Resolve to #BeResilient. Read more about the threat and mitigation steps at Safeguarding Our Critical Infrastructure.

See Original Post

Reposted from CISA/DHS

During the holiday season, you may receive emails or text messages about a deal you just can’t miss, or an opportunity to give for charities you don’t recognize. Sadly, during this season of giving, we must all be on the lookout for scammers who use tactics like asking you to click on a link that installs malware on your device or creating a fake online store to trick you into buying from them, resulting in your money or even your identity being stolen. So how big of a problem are holiday online shopping scams? According to the FBI, almost 12,000 victims reported scams during the 2022 holiday shopping season, resulting in over $73 million in losses. The good news is that Secure Our World has tips to protect you and your family, friends and business from these scams. Visit our Holiday Online Shopping web page for additional tips and to learn more. 

See Original Post

Reposted from CHRTF

Free Online Conference 

When-December 2-5, 2024

Disaster Risk Managment for Cultural Heritage

Focus on Conservation 2024

What are the risks for objects in our collections? What can we do to protect them before, during, and after disaster strikes?

This international conference will look into preparation, response, training, research, and networks to address and mitigate the effect of disasters on cultural heritage.

Participation is free, registration required.

See Original Post

Reposted from EMR-ISAC

Weather and climate change can drastically impact how we prepare for and respond to environmental emergencies.

The State of Michigan’s Department of Environment, Great Lakes, and Energy (EGLE) is hosting a webinar on Wednesday, Nov. 20 at 1 p.m. EDT, The National Weather Service: An Important Partner in Emergency Preparedness, Response, and Recovery. This webinar is part of Michigan EGLE’s Environmental Emergency Preparedness and Response series.

This webinar will feature a presentation from Jim Maczko, a Warning Coordination Meteorologist with the National Weather Service, who will discuss:

• National Weather Service engagement with emergency management in preparedness/mitigation, response, and recovery.
• Weather versus climate and how changes in climate translate into outcomes that affect people.
• National Weather Service flood forecasts- from long-range outlooks to real-time emergency warnings.

Register for this webinar on Zoom.

See Original Post

Reposted from EMR-ISAC

Last month, the U.S. Secret Service’s (USSS’) National Threat Assessment Center released a guide designed to help state and local law enforcement develop programs to prevent targeted violence in the United States.

The guide, Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence, outlines how state and local law enforcement agencies can develop behavioral threat assessment units (BTAUs). These units are specifically designed to identify, assess, and intervene with individuals identified as posing a risk of violence. The ultimate goal of behavioral threat assessment units should be prevention. A structured behavioral threat assessment process can empower agencies, within all existing legal and constitutional parameters, to prevent future tragedies and loss of life.

The guide lists six steps for creating and operating a BTAU. The steps in the guide describe how agencies can adopt the principles of the Secret Service model to proactively identify and intervene with those who intend to carry out acts of targeted violence in their communities. These steps are not intended to be prescriptive but rather offer a scalable blueprint that can be implemented by agencies varying in size, structure, and resources.

See Original Post

Reposted from CISA/DHS

The Cybersecurity and Infrastructure Security Agency, in partnership with the Federal Bureau of Investigation, National Security Agency, and cybersecurity authorities of Australia, Canada, New Zealand, United Kingdom, published a joint Cybersecurity Advisory (CSA) on 2023 Top Routinely Exploited Vulnerabilities | CISA, covering 47 common vulnerabilities and exposures (CVEs) that were routinely or often exploited by malicious actors last year and each CVE includes associated common weakness enumeration.   A secure by design approach from software manufacturers could have reduced or even eliminated the vulnerabilities listed in this advisory. By prioritizing security during the design and development phase of the product development lifecycle, manufacturers could implement aggressive adversarial product testing, thereby identifying and eliminating software flaws before release. This proactive approach would help close common entry points, harden systems against attacks, and minimize the potential for zero-day exploitation by malicious actors, ultimately protecting enterprise networks and high-value targets from preventable vulnerabilities. 

Compared to our 2022 report, malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks which allowed them to conduct cyber operations against higher-priority targets. These actors continue to have the most success exploiting vulnerabilities within two years after public disclosure of the vulnerability. Log4Shell (CVE-2021-44228) remains one of the top routinely exploited vulnerabilities.  A key finding is that international cybersecurity efforts on a zero-day reduces the utility and lifespan of that vulnerability to be used by malicious cyber actors. Those efforts include:  

• Implementing security-centered product development lifecycles that include robust testing environments and threat modeling that is implemented throughout product development.     
• Increasing incentives for responsible vulnerability disclosure, such as bug bounty programs with compensation and recognition to researchers for their contributions.  
• Using sophisticated endpoint detection and response tools such as leveraging EDR solutions that may improve detection rate of zero-day exploits.  

 

End-user organizations are encouraged to implement recommended mitigations in this advisory, including applying timely patches to systems. At the same time, CISA continues work to shift the responsibility of secure software from the customer to software manufacturers and make products Secure by Design.   Although this report is on 2023 activity, the assessment and vulnerability data are relevant and useful because malicious cyber actors continue to exploit older vulnerabilities. Until properly mitigated, these CVEs will continue to pose significant risks to organizations. 

See Original Post

Reposted from HENTF

SAVE THE DATE

FOCUS ON CONSERVATION 2024 – DISASTER RISK

MANAGEMENT FOR CULTURAL HERITAGE

DECEMBER 2–5, 2024, ONLINE CONFERENCE,

FREE PARTICIPATION, REGISTRATION REQUIRED

What are the risks for objects in our collections?

What can we do to protect them before, during and after disaster strikes?

This international conference will look into preparation, response, training,

research and networks to address and mitigate the effect of disasters on cultural heritage.

Save the dates to be part of this four-day online conference – participation is free, but registration is required.

See Original Post

Reposted from ArtSentry

As many museums continue to face tighter budgets, finding efficient ways to maintain high standards with limited resources is essential. Staffing costs, a significant part of museum budgets, require innovative approaches to stretch funds without compromising visitor experience or collection care. Strategies such as community-based cooperative volunteer programs, advanced monitoring technology, and flexible digital staff training can all help museums make the most of their resources, supporting their mission and financial sustainability. Read on for some innovative approaches' museums have used to maximize their staffing resources

Volunteer & Co-op Membership Programs

Innovative cooperative volunteer programs offer museums a powerful way to extend their budgets and bring fresh energy to their operations. By involving community members and young people in roles like exhibit guides and event assistants, museums can reduce staffing costs while creating opportunities for engagement and learning. Museums like the Eiteljorg Museum in Indianapolis, The Museum of Russian Art (TMORA) in Minneapolis, the Smithsonian Institution, and the High Museum of Art in Atlanta offer enticing benefits to volunteers, recognizing their critical role in supporting operations and visitor experiences. Volunteers at these museums often receive perks like free or discounted memberships, admission to special events, and shop discounts. These benefits make volunteering a rewarding, mutually beneficial arrangement, encouraging community involvement while allowing volunteers to immerse themselves more deeply in the museum’s offerings.

Leveraging Technology for Staff Efficiency

Museums increasingly leverage advanced digital tools to enhance security and streamline visitor management. These technologies reduce costs, allowing fewer staff to effectively oversee larger areas without compromising safety. Art Sentry’s camera-based protection system, with its audible alerts and discreet guard notifications, enables each guard to monitor up to three times the typical number of galleries. This optimized guard allocation not only safeguards collections but also creates a more seamless, welcoming environment for visitors, enhancing their overall experience.

Extend the Reach of Digital Collections

Digital collections access initiatives, such as the exceptional digital collections offered by the National Gallery of Art, The Getty, and the Rijksmuseum, allow for a broader reach without requiring a physical presence, indirectly aiding in budget management by lowering in-person visitor surges. Creating online school and group tours and bringing museum stores online can help monetize digital visits. While digitizing collections can be intimidating for museums on a budget, programs and grants are available to help.

Some larger museums and organizations have developed programs to assist smaller institutions in digitizing their collections, promoting access and preservation. The Smithsonian Institution’s Digitization Program Office (DPO) provides best practices and resources to museums looking to digitize their collections, supporting them with high-quality imaging techniques and digitization workflows. Similarly, the British Museum offers its expertise to smaller institutions globally through its Knowledge Sharing Program, guiding digitization processes.

Several U.S.-based grant programs fund digitization for smaller museums. The Institute of Museum and Library Services (IMLS) offers Museums for America and Inspire! Grants for Small Museums aimed to support projects that improve collections access, including digitization. The Council on Library and Information Resources (CLIR) provides grants through its Digitizing Hidden Special Collections and Archives program, which funds the digitization of rare and unique content, enhancing public access. The National Endowment for the Humanities (NEH) also offers grants for Humanities Collections and Reference Resources to support digital access to humanities collections. The Digital Empowerment Project for Small Museums, also funded by IMLS, provides training on digital strategies and collections management for smaller institutions.

These initiatives and collaborations help ensure that institutions of all sizes can participate in the digital preservation and sharing of cultural heritage materials across the United States.

Digitally Training Staff for Cost Efficiency

Digital training solutions allow museums to efficiently upskill their employees without the logistical costs of in-person sessions, such as instructor fees, meeting space, and travel reimbursement. Digital modules can be accessed on-demand, making it easier for staff to stay updated on the latest security protocols and operational changes. This flexible format reduces training expenses and ensures that employees receive timely, consistent instruction on new technology, security protocols, and visitor management practices, creating a more agile and knowledgeable workforce.

These examples illustrate how a strategic blend of staffing models, community engagement, and smart technology can impact museums’ operational efficiency and budget management. For more information on maximizing your budget, download our digital guide here.

See Original Post